Customer Centric Banking - PwC

Digital transformationThe scenario of banks turning into dumb pipes is oftenoverstated and there is a historical reason for that. Indeed,digital transformation has always been a steep challenge formost incumbent organisations in any industry. In fact, only somany examples can be found where an incumbentorganisation has succesfully transformed itself to competesuccessfully against digital-first disruptors. Even in thecapital intensive airline industry that has very high barriersto entry, digital transformation initiatives have taken over adecade to yield results.Despite the dire predictions, so far incumbent FinancialServices organisations have stood their ground well against thedisruptors. Outside of China and India, waves upon waves ofFintechs such as P2P lenders, new payments providers likeTransferwise and Ripple and now mobile only banks have so faronly made a minor dent in the walls of the formidable fortressesthat the big banks are. However, with the nimble, innovativeand digital-first Fintechs finding progressively greater capitalinvestment and regulatory support in most markets, the threathas continued to grow, and digital transformation is no longeran option for Financial Services organisations.Financial services firms see the mainpotential of FinTech investment over thenext three years to be in:Processautomation1Dataanalytics2Source: Q4 2016 CBI/PwC survey4 Customer centric banking PwCIt may appear that in a post PSD II environment, Banks (ASPSPs)would be at a risk of essentially functioning as Account andDeposit holders for customers, and mainly providing access tothird parties (PISPs and AISPs) that own the customerinteraction on the front end. In this scenario, Banks willessentially provide infrastructure similar to utilities whereasTPPs capture the high margins and customer mindshare fromowning the user experience of value added services.For example, the banks’ telephone, mobile and internetbanking services will face stiff competition from innovativestartups, telecoms organisations, retailers, Silicon Valleycompanies and others. Our latest CBI/PwC survey found that71% of banks see competition coming from new entrants (thehighest since the Survey began in December 2006).This scenario is bearable only for a small number of sprawlingbanks that derive their revenue primarily from interest rates onlending. However, for most banks under growing pressure fromshareholders to create new revenue and increase their returnon equity, becoming a ‘dumb pipe’ is not an acceptable outcome.Indeed, banks today are quite concerned about the risk ofbeing reduced to pure infrastructure providers or ‘dumbpipes’, in the same way that telecoms network providers likeAT&T and Sprint were turned into pipes and plumbing forcommunications by smartphones from Apple.Platforms and marketplacesDue to the complexity of transforming critical legal,technology and data infrastructure, recent years have seenthe emergence of the bank as a marketplace, or the bank asplatform business model. These models generally seek to takeadvantage of the bank’s data, access to customers andstrengths in regulatory compliance and resilience whilecreating a digital system where nimble and agile Fintechs canquickly deliver innovative services to the bank’s customers.Inspired by the stunning success of Apple and Amazon inbuilding content and retail ecosystems, these business modelslook to transform incumbent financial services organisationsfrom monoliths into thriving financial ecosystems.3DigitaltransformationDumb pipesSimilarly, recent years have seen extensive discussion aboutthe Uberisation of just about everything. Inspired by the rapidmarket dominance of Uber, Airbnb and Spotify that collect aper transaction fee merely by connecting consumers andservice providers using asset-light digital platforms, banks arestarting to think beyond merely controlling access to customerdata and payments rails and opening these assets up to thirdparties to increase ROE by reducing the asset base andimproving their asset turnover (sales/assets).APIs, the pathway to digital transformationAn API based architecture, essentially mandated by PSD IIprovides the simplest pathway to transforming a sprawlinglegacy bank first into a platform (like Facebook), and then intoa marketplace (like Amazon). While varying widely in theirquality and scope of implementation, almost all major bankscurrently have open API initiatives that will allow third partydevelopers to use APIs to build innovative consumer facingapplications. Many banks state that they have had internal APIplatforms for years, that the technology and controlssurrounding these APIs are mature and well understood andthat opening up APIs to third parties in a careful andconsidered manner is the logical next step.

Connecting PSD II and GDPRConsent, purpose and durationThese three concepts form the core of a GDPR compliant PSDII implementation. While digital marketers will naturally beexcited about the opportunity to cross-sell services toconsumers by capturing data and context metadata, the GDPRessentially forbids doing so without clear consumer consentlimited by both a clear purpose and duration. Above all, aconsumer can withdraw consent they provided earlier, andthereby request the removal of all personal data in thepossession of a bank or a third party.This is especially critical so that the accountability for anymisuse can be assigned correctly, for example, when a thirdparty may be at fault. Let’s go through these concepts in turn.ConsentThe key to being able to collect and leverage consumer datarequires making sure that the organisation and its thirdparties have specific consent from the consumer for their dataused in a transparent manner.PurposeThe consent should capture the broad parameters of how thedata may be used. If such data is to be shared with thirdparties, consumer agreements must capture with whom thedata may be shared and how it may be used by third parties.Consent must be informed consentAny legal agreements or T&Cs must be adequately clear andspecific so that the consent of the user can be characterised asinformed consent. Further, if the user journeys involving thecapture of consent information obscure what the customerneeds to know e.g. through unusually long agreements or toomany clicks, a privacy lawyer can in theory even argue thatthe consent was not really informed consent.The right to be forgottenThe GDPR gives every individual the right to revoke theirconsent. Businesses must be able to stop using the consumer’sdata for which the consent has been revoked and in somecases remove the data altogether from the organisation.Open Banking increases probabilityof incidents, GDPR increases severityof impactPSD II allows third party actors to provide the public with accessto financial data and services that traditionally the bank directlycontrolled. Given the objective of creating fair and open accessfor third parties, the regulation does not provide a framework tohave contractual liabilities in place, so the bank has little controlover how these 3rd parties will operate or behave. Some of thepotential exposure scenarios are:1. A third party uses the bank’s data to engage in misselling(potential Conduct Risk implications)2. A third party violates the terms of a customer’s consent forthe use of data3. A third party enables hackers to bypass the bank’scybersecurity controls4. A third party aggregates and sells customer data to otherthird parties, potentially even in sanctioned jurisdictions5. A third party combines a customer’s social and transactiondata to mine their identity information and engages inidentity fraud, or worse6. A third party exposes the bank’s API to denial of serviceattacks, leading to severe difficulty for customers whoneed access to payment servicesIn all of these scenarios, the main risk exposure to the bankcomes from their role as the custodian of the customer’s dataand the owner of the customer relationship. Even if it is a thirdparty that fails to manage their GDPR obligations, thereputational risk may lie predominantly with the incumbentbanks because they have the reputation to lose in the firstplace, as opposed to let’s say a startup using the API. Even ifthe banks can position themselves to avoid actual directfinancial liability under GDPR

banking services will face stiff competition from innovative startups, telecoms organisations, retailers, Silicon Valley companies and others. Our latest CBI/PwC survey found that 71% of banks see competition coming from new entrants (the highest since the Survey began in December 2006). This scenario is bearable only for a small number of sprawling banks that derive their revenue primarily .